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CLAIMS 
We claim: 

1. A method of handling personally identifiable information, said 
method comprising: 

defining a limited number of privacy-related actions regarding 
said personally identifiable information; 

constructing a rule for each circumstance in which one of said 
privacy- related actions may be taken or must be taken; 
allowing for the input of dynamic contextual information to 
precisely specify the condition for evaluation of said rule; 
creating a programming object containing at least one of said 
rules ; 

associating said programming object with said personally 
identifiable information; 
processing a request; and 
providing an output . 

2. The method of Claim 1, wherein said output is selected from 
the group consisting of 

authorizing said privacy-related action, 

authorizing said privacy-related action, plus specifying one or 
more tasks, 

and denying said request but also suggesting what must be done to 
have said. request approved. 

3. The method of Claim 1, wherein said output includes the 
specification of at least one additional action that must be 
taken. 

4. A system for handling personally identifiable information, 
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said system comprising: 

means for defining a limited number of privacy-related actions 
regarding said personally identifiable information; 
means for constructing a rule for each circumstance in which one 
of said privacy- related actions may be taken or must be taken; 
means for allowing for the input of dynamic contextual 
information to precisely specify the condition for evaluation of 
said rule; 

means for creating a programming object containing at least one 
of said rules; 

means for associating said programming object with said 
personally identifiable information; 
means for processing a request; and 
means for providing an output . 

5. The system of Claim 4, wherein said output is selected from 
the group consisting of 

authorizing said privacy-related action, 

authorizing said privacy-related action, plus specifying one or 
more tasks, 

and denying said request but also suggesting what must be done to 
have said request approved. 

6. The system of Claim 4, wherein said output includes the 
specification of at least one additional action that must be 
taken. 

7. A computer-usable medium having computer- executable 
instructions for handling personally identifiable information, 
said computer-executable instructions comprising: 
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means for defining a limited number of privacy-related actions 
regarding said personally identifiable information; 
means for constructing a rule for each circumstance in which one 
of said privacy-related actions may be taken or must be taken; 
means for allowing for the input of dynamic contextual 
information to precisely specify the condition for evaluation of 
said rule; 

means for creating a programming object containing at least one 
of said rules; 

means for associating said programming object with said 
personally identifiable information; 
means for processing a request; and 
means for providing an output. 

8. The computer-usable medium of Claim 7, wherein said output is 
selected from the group consisting of 

authorizing said privacy- related action, 

authorizing said privacy-related action , plus specifying one or 
more tasks, 

and denying said request but also suggesting what must be done to 
have said request approved. 

9. The computer-usable medium of Claim 7, wherein said output 
includes the specification of at least one additional action that 
must be taken. 



